Beat
Linux Kernel
Upstream Linux kernel development news
A leftover giant-packet mark on an IP fragment can panic the host
A tap or a guest can attach giant-packet metadata to a single IP fragment. After the host glues the pieces back together, that leftover mark sends the kernel into a BUG that panics the machine.
AppArmor writes past a profile-name list when a process sets its own confinement
AppArmor builds a list of profile names when a process asks to change its own confinement. The list was one slot short for the terminator, so a long compound name wrote a pointer past the end.
AppArmor can free a process's credentials while they are still in use
AppArmor is the Linux security module that pins a confinement profile to each process. When a profile was replaced or disabled, it swapped that process's credentials from inside filesystem work, so a later lookup could touch freed memory.
OpenRISC signal return let a local process drop memory protection
OpenRISC is a small CPU architecture used in QEMU and on FPGA boards. A local process could return from a signal with a crafted frame that turned off memory protection, then read and write any physical address.